Rezultat naprawy Farbar Recovery Scan Tool (x64) Wersja:09-12-2015 Uruchomiony przez Martyna (2015-12-12 00:35:52) Run:1 Uruchomiony z C:\Users\Martyna\Desktop Załadowane profile: Martyna (Dostępne profile: Martyna) Tryb startu: Normal ============================================== fixlist - zawartość: ***************** CloseProcesses: CreateRestorePoint: R2 IhPul; C:\Users\Martyna\AppData\Roaming\TSv\TSvr.exe [580752 2015-12-08] (tsvr.com) ShortcutWithArgument: C:\Users\Martyna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH <==== UWAGA ShortcutWithArgument: C:\Users\Martyna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH <==== UWAGA StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1446652810&z=718b202b9de16d61dadb4ddgez1zdq9q4w7o3w2c6w&from=cor&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH&q={searchTerms} HKU\S-1-5-21-2990691196-1889282507-3086637898-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH HKU\S-1-5-21-2990691196-1889282507-3086637898-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH&q={searchTerms} SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH&q={searchTerms} SearchScopes: HKU\S-1-5-21-2990691196-1889282507-3086637898-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449644369&z=1c58de2ec1467e73980762ag5zaz8taq9z0z0cewez&from=ient07021&uid=WDCXWD5000LPVX-22V0TT0_WD-WXA1E940RUEH0RUEH&q={searchTerms} Task: {43BFE57B-1A61-4AFA-B93A-D19DC7EF1ABA} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-08] (Lenovo) Task: {EF1597A4-4ECA-402E-944B-76D8B54F456E} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe HKU\S-1-5-18\...\Run: [abDocsDllLoader] => C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" DeleteKey: HKCU\Software\1Q1F1S1C1P1E1C1F1N1C1T1H2UtF1E1I DeleteKey: HKCU\Software\dobreprogramy DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 DeleteKey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Lenovo DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software DisableService: Orange Connection. RunOuc RemoveDirectory: C:\Program Files (x86)\Lenovo RemoveDirectory: C:\ProgramData\7WMiniPro7 RemoveDirectory: C:\ProgramData\8WMiniPro8 RemoveDirectory: C:\ProgramData\UWdMU RemoveDirectory: C:\Users\Martyna\AppData\Local\Google RemoveDirectory: C:\Users\Martyna\AppData\Local\Lenovo RemoveDirectory: C:\Users\Martyna\AppData\Roaming\istartpageing RemoveDirectory: C:\Users\Martyna\AppData\Roaming\TSv RemoveDirectory: C:\Windows\System32\Tasks\Lenovo CMD: del /q C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat EmptyTemp: ***************** Procesy zostały pomyślnie zamknięte. Punkt przywracania został pomyślnie utworzony. IhPul => serwis pomyślnie usunięto C:\Users\Martyna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Skrót - argument pomyślnie usunięto. C:\Users\Martyna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => Skrót - argument pomyślnie usunięto. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Wartość pomyślnie przywrócono HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Wartość pomyślnie przywrócono HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Wartość pomyślnie przywrócono HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Wartość pomyślnie przywrócono HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Wartość pomyślnie przywrócono HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Wartość pomyślnie przywrócono HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Wartość pomyślnie przywrócono HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Wartość pomyślnie przywrócono HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Wartość pomyślnie przywrócono HKU\S-1-5-21-2990691196-1889282507-3086637898-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Wartość pomyślnie przywrócono HKU\S-1-5-21-2990691196-1889282507-3086637898-1001\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Wartość pomyślnie przywrócono HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wartość pomyślnie przywrócono "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => klucz pomyślnie usunięto HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => klucz nie znaleziono. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wartość pomyślnie przywrócono "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => klucz pomyślnie usunięto HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => klucz nie znaleziono. "HKU\S-1-5-21-2990691196-1889282507-3086637898-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => klucz pomyślnie usunięto HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => klucz nie znaleziono. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{43BFE57B-1A61-4AFA-B93A-D19DC7EF1ABA}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{43BFE57B-1A61-4AFA-B93A-D19DC7EF1ABA}" => klucz pomyślnie usunięto C:\Windows\System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => pomyślnie przeniesiono "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Lenovo\Lenovo Customer Feedback Program 64" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{EF1597A4-4ECA-402E-944B-76D8B54F456E}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EF1597A4-4ECA-402E-944B-76D8B54F456E}" => klucz pomyślnie usunięto C:\Windows\System32\Tasks\BacKGroundAgent => pomyślnie przeniesiono "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BacKGroundAgent" => klucz pomyślnie usunięto HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\abDocsDllLoader => Wartość pomyślnie usunięto "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc" => klucz pomyślnie usunięto "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc" => klucz pomyślnie usunięto HKCU\Software\1Q1F1S1C1P1E1C1F1N1C1T1H2UtF1E1I => klucz pomyślnie usunięto HKCU\Software\dobreprogramy => klucz pomyślnie usunięto HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 => niepowodzenie przy usuwaniu w pierwszym podejściu (ErrorCode: C0000121), zobacz kolejną linię. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 => klucz pomyślnie usunięto HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Lenovo => klucz pomyślnie usunięto HKLM\SOFTWARE\Wow6432Node\yoursites123Software => niepowodzenie przy usuwaniu w pierwszym podejściu (ErrorCode: C0000121), zobacz kolejną linię. HKLM\SOFTWARE\Wow6432Node\yoursites123Software => klucz pomyślnie usunięto Orange Connection. RunOuc => usługę wyłączono "C:\Program Files (x86)\Lenovo" => pomyślnie usunięto. "C:\ProgramData\7WMiniPro7" => pomyślnie usunięto. "C:\ProgramData\8WMiniPro8" => pomyślnie usunięto. "C:\ProgramData\UWdMU" => pomyślnie usunięto. "C:\Users\Martyna\AppData\Local\Google" => pomyślnie usunięto. "C:\Users\Martyna\AppData\Local\Lenovo" => pomyślnie usunięto. "C:\Users\Martyna\AppData\Roaming\istartpageing" => pomyślnie usunięto. "C:\Users\Martyna\AppData\Roaming\TSv" => pomyślnie usunięto. "C:\Windows\System32\Tasks\Lenovo" => pomyślnie usunięto. ========= del /q C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat ========= ========= Koniec CMD: ========= EmptyTemp: => 47.4 MB danych tymczasowych Usunięto. System wymagał restartu. ==== Koniec Fixlog 00:36:50 ====